Commit f2c24be5 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf 

Daniel Borkmann says:

====================
bpf 2022-11-04

We've added 8 non-merge commits during the last 3 day(s) which contain
a total of 10 files changed, 113 insertions(+), 16 deletions(-).

The main changes are:

1) Fix memory leak upon allocation failure in BPF verifier's stack state
   tracking, from Kees Cook.

2) Fix address leakage when BPF progs release reference to an object,
   from Youlin Li.

3) Fix BPF CI breakage from buggy in.h uapi header dependency,
   from Andrii Nakryiko.

4) Fix bpftool pin sub-command's argument parsing, from Pu Lehui.

5) Fix BPF sockmap lockdep warning by cancelling psock work outside
   of socket lock, from Cong Wang.

6) Follow-up for BPF sockmap to fix sk_forward_alloc accounting,
   from Wang Yufen.

bpf-for-netdev

* tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  selftests/bpf: Add verifier test for release_reference()
  bpf: Fix wrong reg type conversion in release_reference()
  bpf, sock_map: Move cancel_work_sync() out of sock lock
  tools/headers: Pull in stddef.h to uapi to fix BPF selftests build in CI
  net/ipv4: Fix linux/in.h header dependencies
  bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE
  bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues
  bpf, verifier: Fix memory leak in array reallocation for stack state
====================

Link: https://lore.kernel.org/r/20221104000445.30761-1-daniel@iogearbox.net


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 9521c9d6 475244f5

include/linux/skmsg.h

+1 −1
Original line number Diff line number Diff line
@@ -376,7 +376,7 @@ static inline void sk_psock_report_error(struct sk_psock *psock, int err) 
}



struct sk_psock *sk_psock_init(struct sock *sk, int node);

void sk_psock_stop(struct sk_psock *psock, bool wait);

void sk_psock_stop(struct sk_psock *psock);



#if IS_ENABLED(CONFIG_BPF_STREAM_PARSER)

int sk_psock_init_strp(struct sock *sk, struct sk_psock *psock);

include/uapi/linux/in.h

+1 −0
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#define _UAPI_LINUX_IN_H



#include <linux/types.h>

#include <linux/stddef.h>

#include <linux/libc-compat.h>

#include <linux/socket.h>

kernel/bpf/verifier.c

+13 −4
Original line number Diff line number Diff line
@@ -1027,12 +1027,17 @@ static void *copy_array(void *dst, const void *src, size_t n, size_t size, gfp_t 
 */

static void *realloc_array(void *arr, size_t old_n, size_t new_n, size_t size)

{

	void *new_arr;



	if (!new_n || old_n == new_n)

		goto out;



	arr = krealloc_array(arr, new_n, size, GFP_KERNEL);

	if (!arr)

	new_arr = krealloc_array(arr, new_n, size, GFP_KERNEL);

	if (!new_arr) {

		kfree(arr);

		return NULL;

	}

	arr = new_arr;



	if (new_n > old_n)

		memset(arr + old_n * size, 0, (new_n - old_n) * size);
@@ -6618,8 +6623,12 @@ static int release_reference(struct bpf_verifier_env *env, 
		return err;



	bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({

		if (reg->ref_obj_id == ref_obj_id)

		if (reg->ref_obj_id == ref_obj_id) {

			if (!env->allow_ptr_leaks)

				__mark_reg_not_init(env, reg);

			else

				__mark_reg_unknown(env, reg);

		}

	}));



	return 0;

net/core/skmsg.c

+2 −5
Original line number Diff line number Diff line
@@ -803,16 +803,13 @@ static void sk_psock_link_destroy(struct sk_psock *psock) 
	}

}



void sk_psock_stop(struct sk_psock *psock, bool wait)

void sk_psock_stop(struct sk_psock *psock)

{

	spin_lock_bh(&psock->ingress_lock);

	sk_psock_clear_state(psock, SK_PSOCK_TX_ENABLED);

	sk_psock_cork_free(psock);

	__sk_psock_zap_ingress(psock);

	spin_unlock_bh(&psock->ingress_lock);



	if (wait)

		cancel_work_sync(&psock->work);

}



static void sk_psock_done_strp(struct sk_psock *psock);
@@ -850,7 +847,7 @@ void sk_psock_drop(struct sock *sk, struct sk_psock *psock) 
		sk_psock_stop_verdict(sk, psock);

	write_unlock_bh(&sk->sk_callback_lock);



	sk_psock_stop(psock, false);

	sk_psock_stop(psock);



	INIT_RCU_WORK(&psock->rwork, sk_psock_destroy);

	queue_rcu_work(system_wq, &psock->rwork);

net/core/sock_map.c

+4 −3
Original line number Diff line number Diff line
@@ -1596,7 +1596,7 @@ void sock_map_destroy(struct sock *sk) 
	saved_destroy = psock->saved_destroy;

	sock_map_remove_links(sk, psock);

	rcu_read_unlock();

	sk_psock_stop(psock, false);

	sk_psock_stop(psock);

	sk_psock_put(sk, psock);

	saved_destroy(sk);

}
@@ -1619,9 +1619,10 @@ void sock_map_close(struct sock *sk, long timeout) 
	saved_close = psock->saved_close;

	sock_map_remove_links(sk, psock);

	rcu_read_unlock();

	sk_psock_stop(psock, true);

	sk_psock_put(sk, psock);

	sk_psock_stop(psock);

	release_sock(sk);

	cancel_work_sync(&psock->work);

	sk_psock_put(sk, psock);

	saved_close(sk, timeout);

}

EXPORT_SYMBOL_GPL(sock_map_close);